外掛標籤
開發者團隊
原文外掛簡介
Global AI Chat puts a helpful AI assistant on your website that talks to your visitors 24/7. It welcomes people, answers their questions in plain language, points them to the right page, and quietly turns those conversations into leads — so you capture interest even while you sleep.
It runs on OpenAI’s models using your own OpenAI key, so you stay in control and OpenAI bills you directly for what you use. No middle-man, no monthly plugin fee.
Everything here is free and fully functional — no trials, no locked buttons, no time limits, no “upgrade to continue”.
Why you’ll like it
Up and running in minutes — paste your OpenAI key, pick a personality (Support, Sales/SDR or FAQ), and you’re live.
Looks like part of your brand — customise colours, icon, position and the welcome message.
Turns chats into leads — the assistant naturally collects name, email, phone, company and any custom field you want, and saves them for you.
Works everywhere you build — a floating widget, the [growthai_chat] shortcode, plus blocks for Gutenberg, Elementor, Divi, Beaver Builder and WPBakery.
Speaks your visitor’s language — automatically replies in the visitor’s browser language.
Knows your content — upload documents so the assistant answers from your own material, not guesses.
Privacy-friendly — optional cookie-consent banner and a one-click “delete all my data on uninstall” switch. Your conversations stay in your own database.
Go further with Global AI Chat Pro
When you’re ready to scale, the optional Global AI Chat Pro add-on builds right on top of this free plugin. It’s a separate download — learn more at https://globalai.software/plugin-global-ai-chat. Install it and everything you already set up keeps working; remove it and the free plugin carries on exactly as before. Nothing to migrate, nothing to lose.
Pro unlocks the features businesses ask for most:
Live human takeover — jump into any conversation from the iOS & Android app and reply as a real person, with push notifications the moment a visitor needs you.
One app for all your sites — the mobile app manages multiple WordPress sites from a single login, so agencies and multi-brand teams handle every conversation in one place.
Voice calls — let a visitor start a voice call with your team straight from the chat, answered live in the app.
Unlimited agents — run separate assistants for sales, support, FAQ and more, each with its own prompt, look and knowledge.
No OpenAI key needed — switch to managed AI billed by simple token packs, with access to top models — perfect if you’d rather not manage an OpenAI account.
Auto-sync your whole site — pages, posts and WooCommerce products are indexed automatically so the assistant always answers with up-to-date info.
AI Prompt Generator — a guided wizard writes a high-quality agent prompt for you in a couple of minutes.
Booking built in — connect Google Calendar and let the assistant schedule meetings.
Send leads anywhere — outbound webhooks push every captured lead to your CRM or automation tool.
Never miss a lead — instant email + mobile push the moment someone becomes a lead.
White-label — remove the “Powered by” badge and make the widget fully your own.
One-click auto-updates and conversation analytics.
See the screenshots below for a look at both the free widget and the Pro features.
External services
This plugin relies on one third-party service: the OpenAI API. No other external endpoint is contacted by the free plugin.
OpenAI API (required)
What it is: OpenAI provides the language model that generates chat replies and, when you upload knowledge-base documents, runs the file search against them.
What is sent: Every chat message the visitor submits, plus the system prompt your agent is configured with, is sent to https://api.openai.com/v1/responses using your own API key. When you upload training documents, the file bytes are sent to https://api.openai.com/v1/files and registered with https://api.openai.com/v1/vector_stores so the agent can search them.
When: On every user message (chat completion) and only when an admin manually uploads/deletes a knowledge-base document (vector store).
Terms of service: https://openai.com/policies/terms-of-use
Privacy policy: https://openai.com/policies/privacy-policy
Not contacted by this free plugin
The companion Pro addon (separate download, not on wp.org) introduces additional endpoints under https://saas.globalai.software/ for license verification, managed token billing, mobile-app push notifications, plugin auto-updates, Google Calendar OAuth, outbound webhooks, page/post auto-sync, and the AI prompt generator. None of those endpoints are reached from this free plugin’s code — they are documented here only so admins know what changes if they later install the Pro addon.
Security
Visitor session token (`session_id`)
Every chat conversation is bound to a session_id token generated client-side, in the visitor’s browser, using window.crypto.getRandomValues (a 128-bit cryptographically random value rendered as 32 hex characters with the prefix gai_). The token is stored in localStorage after the visitor accepts the cookie consent banner; without consent, an in-memory ephemeral token is used and discarded when the tab closes.
The session_id is the access key for the chat REST endpoints (/wp-json/growthai/v1/chat, /wp-json/growthai/v1/live-chat/poll). These endpoints are intentionally public (permission_callback => __return_true) so that anonymous site visitors can chat without needing a WordPress account — knowing the token is what authorises the request, the same security model used by mainstream chat / support widgets (Crisp, Tawk, Intercom).
Implications:
The token is not derived from the IP, User-Agent, cookies the server sets, or any sequential / predictable scheme. A third party cannot guess another visitor’s token.
The plugin never logs full session_id values in plaintext outside the database row that owns the conversation.
If the visitor clears their browser storage, the next page load gets a fresh token and a fresh conversation.
Old browsers without the Web Crypto API fall back to Math.random() — a worse entropy source. We surface this in the JS for transparency; if your audience relies on legacy browsers, factor that into your threat model.
