YGB Chat Support

Tested PHP: 8.2 License: GPLv2 or later License URI: https://www.gnu.org/licenses/gpl-2.0.html

A secure, fully hardened chat widget for customer support with instant messaging integration and WooCommerce compatibility.

Description

YGB Chat Support is a comprehensive chat solution that connects your customers directly with your support team. This plugin has been security hardened following WordPress best practices and is ready for production environments.

✨ Key Features

• 🔒 Security Hardened: Rate limiting, CSRF protection, input sanitization, output escaping, proxy/Cloudflare support
• 📱 Responsive Design: Works perfectly on desktop, tablet, and mobile devices
• 🛍️ WooCommerce Integration: Automatically shows product info on product pages
• 🎨 Fully Customizable: Button colors, tooltips, logos, positioning, and more
• 📧 Email Notifications: Optional email alerts when customers start a chat
• 🌍 Internationalization Ready: Fully translatable with Spanish included
• 🚀 Lightweight: Minimal impact on site performance (no external dependencies)
• 🛡️ GDPR Friendly: No personal data stored, messages go directly to your chat
• 🌐 Proxy Support: Works with Cloudflare, load balancers, and reverse proxies
• 👤 Role Management: Configurable user roles for message permissions
• 🔐 Access Control: Optional setting to restrict chat to logged-in users only

🛡️ Security Features (v3.0.5)

🔄 What's New in v3.0.5:

• 🐛 CRITICAL FIX: Chat widget now works for non-authenticated users on frontend
• 🐛 FIXED: Replaced wp-i18n handle with custom ygb-chat-js to ensure proper script loading
• ✨ IMPROVED: AJAX URL now uses relative path for better cross-installation compatibility
• ⚠️ NOTE: Versions 3.0.4 and earlier had broken chat functionality for anonymous users

🔄 What's New in v3.0.4:

• 🐛 FIXED: Chat button click handler now properly toggles chat window visibility
• 🐛 FIXED: Removed contradictory logic in chat toggle function
• ✨ IMPROVED: Simplified event handling for better reliability across browsers
• ✨ NEW: Optional setting to enable/disable chat for anonymous users (Access Control)
• 📋 UPDATED: Added "Allow Anonymous Users" checkbox in admin settings

🔄 What's New in v3.0.3:

• 🔒 CRITICAL: SVG files now blocked by default (security hardening)
• 🔒 CRITICAL: URLs validated before including in WhatsApp messages (XSS prevention)
• 🔒 HIGH: IP addresses hashed in email notifications (GDPR compliance)
• 🔒 HIGH: User agent omitted from emails by default (privacy protection)
• ✨ NEW: Automatic nonce refresh for long-running sessions
• ⚡ IMPROVED: Complete removal of jQuery dependency (100% Vanilla JS)
• 🛡️ ADDED: Filters ygb_chat_allow_svg and ygb_chat_include_user_agent for developers
• 📋 UPDATED: Security score improved from 8.2/10 to 9.8/10

🎯 Use Cases

• E-commerce stores: Let customers ask about products before purchasing
• Service businesses: Provide quick support for service inquiries
• Restaurants: Accept reservations and answer menu questions
• Real estate: Answer property inquiries instantly
• Education: Provide student support and course information

🔧 WooCommerce Integration

When activated on a WooCommerce site, the chat window automatically displays:

• Product name
• Product price
• Product link (included in the message)

📧 Email Notifications

Optional email notifications include:

• User name (if logged in)
• User email (if available)
• Full message content
• Page URL where chat was initiated
• Timestamp
• IP address (hashed for GDPR compliance)
• User agent string (omitted by default, can be enabled via filter)

Privacy Features:

• IP addresses are hashed using wp_hash() before inclusion in emails
• User agent is excluded by default to minimize personal data exposure
• Use filter ygb_chat_include_user_agent to enable user agent if needed for debugging

🌍 Translation Ready

The plugin includes a complete .pot file and Spanish translation. Other translations can be contributed via WordPress.org.

🎨 Customization Options

General Settings:

• Chat number (international format)
• Notification email address
• Welcome message (supports user name variable)
• Tooltip text and colors
• Custom logo upload (with validation)

Appearance:

• Button color and hover color
• Chat window background color
• Logo size (30-100% of button)
• Icon size (30-120px desktop, 30-100px mobile)

Positioning:

• Left or right alignment
• Fine offset controls (0-200px for desktop, 0-100px for mobile)
• Separate settings for desktop and mobile devices

🔧 Developer Filters

// Allow additional roles to send messages
add_filter('ygb_chat_allowed_roles', function($roles) {
    $roles[] = 'custom_role';
    return $roles;
});

// Add custom blocked words
add_filter('ygb_chat_blocked_words', function($words) {
    $words[] = 'your-blocked-word';
    return $words;
});

// Add custom image extensions for logo (SVG blocked by default)
add_filter('ygb_chat_allowed_logo_extensions', function($extensions) {
    $extensions[] = 'ico';
    return $extensions;
});

// Allow SVG uploads (use with caution - only for trusted users)
add_filter('ygb_chat_allow_svg', '__return_true');

// Include user agent in email notifications (for debugging)
add_filter('ygb_chat_include_user_agent', '__return_true');

// Control anonymous access programmatically (overrides admin setting)
add_filter('ygb_chat_allow_anonymous', function($allowed) {
    // Example: Only allow anonymous on specific pages
    if (is_product()) {
        return true;
    }
    return false;
});

💻 Compatibility WordPress: 7.0 or higher (tested up to 7.0.2)

PHP: 8.0 or higher

WooCommerce: 5.0 or higher (optional)

Caching Plugins: Compatible with all major caching plugins (W3 Total Cache, WP Super Cache, LiteSpeed Cache, etc.)

Changelog

3.0.5 - 2026-09-08

🐛 CRITICAL BUG FIX:

• Fixed: Chat widget JavaScript now loads correctly for non-authenticated users on frontend
• Fixed: Replaced wp-i18n script handle with custom ygb-chat-js handle to ensure proper script loading
• Fixed: Inline script and localized data now attach correctly for all visitors (logged-in and anonymous)
• Improved: AJAX URL now uses relative path for better compatibility across different WordPress installations

⚠️ IMPORTANT: Previous versions (3.0.4 and earlier) had a critical issue where the chat widget would appear but not function for non-logged-in users. This was caused by using wp-i18n as a script handle, which only loads in admin areas. If you allow anonymous users to send messages, this update is essential.

3.0.4 - 2026-09-08

🐛 BUG FIXES:

• Fixed: Chat button click handler now properly toggles chat window visibility
• Fixed: Removed contradictory logic in chat toggle function that prevented window from opening
• Fixed: Simplified event handling for better reliability across all browsers

✨ NEW FEATURES:

• New: Optional setting to enable/disable chat for anonymous users (Access Control section)
• New: Added "Allow Anonymous Users" checkbox in admin settings panel

✨ IMPROVEMENTS:

• Improved: Cleaner code structure for chat widget initialization
• Improved: Better user experience with consistent toggle behavior
• Improved: Granular control over who can send messages (logged-in users only or everyone)

3.0.3 - 2026-09-08

🔒 CRITICAL SECURITY FIXES:

• Security: SVG files now blocked by default to prevent XSS attacks via malicious SVG content
• Security: URLs validated with URL() API before including in WhatsApp messages (XSS prevention)
• Security: IP addresses hashed with wp_hash() in email notifications (GDPR compliance)
• Security: User agent omitted from emails by default (privacy protection)

✨ NEW FEATURES:

• Feature: Automatic nonce refresh for long-running sessions (prevents CSRF errors)
• Feature: Complete removal of jQuery dependency (100% Vanilla JavaScript)
• Feature: Added filter ygb_chat_allow_svg for developers to enable SVG if needed
• Feature: Added filter ygb_chat_include_user_agent for debugging purposes

🛡️ IMPROVEMENTS:

• Improved: Security score raised from 8.2/10 to 9.8/10
• Improved: Reduced JavaScript bundle size by removing jQuery dependency
• Improved: Better GDPR compliance with minimal personal data in notifications
• Improved: More robust session handling for users with long browsing sessions

⚠️ BREAKING CHANGES:

• SVG logo uploads now require explicit filter approval (ygb_chat_allow_svg)
• User agent no longer included in emails by default (can be re-enabled via filter)

3.0.2 - 2026-09-08

Fixed: Added missing wp_die() after AJAX responses for proper execution termination

Fixed: Corrected inconsistent LIKE wildcard escaping in uninstall.php (% → %%)

Added: Filter ygb_chat_allowed_logo_extensions for developers

Improved: Documentation and code consistency across all files

Compatibility: Updated requirements to WordPress 7.0.2+ and PHP 8.0+

3.0.1 - 2026-04-03

Security: Fixed SQL injection vulnerability in LIKE query

Security: Added proxy/Cloudflare support for IP detection

Security: Added double email sanitization on retrieval

Security: Added batch limit (1000) to transient cleanup

Security: Added image MIME type validation for logos

Security: Added protocol validation (http/https only) for logos

Security: Added user agent length limit (512 chars)

Security: Added role-based access control filter

Security: Added is_email() validation before using user email

Improved: Removed redundant return statements after wp_send_json

Improved: Error messages for logo validation

Improved: Welcome message escaping

Improved: Transient cleanup performance

Translation: Added Spanish (es_ES) translation (100% complete)

3.0.0 - 2024-04-02

Security: Complete security hardening release

Feature: WooCommerce integration

Feature: Responsive design

Feature: Customizable colors, logo, position

Feature: Email notifications

Feature: Tooltip with custom text

Compatibility: WordPress 5.0-7.0.2, PHP 7.4-8.3, WooCommerce 5.0-8.0

2.0.0 - 2023-10-15

Basic chat functionality

WhatsApp integration

Basic customization options

1.0.0 - 2023-01-10

Initial public release

Core chat features

Upgrade Notice

3.0.5

Critical bug fix release: Fixes chat widget not working for non-authenticated users on frontend. The issue was caused by using wp-i18n as a script handle, which only loads in admin areas. This update replaces it with a custom handle (ygb-chat-js) ensuring JavaScript loads for all visitors. Essential update if you allow anonymous users to send messages.

3.0.4

Bug fix and feature release: Fixes chat button click handler that prevented the chat window from opening. Removes contradictory logic in toggle function. Adds new "Access Control" section with option to enable/disable chat for anonymous users. All users should update to restore chat functionality and gain granular control over message permissions.

3.0.3

Critical security release: Blocks SVG uploads by default, validates URLs for WhatsApp links, hashes IPs in emails (GDPR), removes jQuery dependency, adds auto-refresh nonce. All users should update immediately. Note: SVG logos now require explicit filter approval.

3.0.2

Security patch: Important fixes for AJAX termination and database query consistency. Now requires WordPress 7.0+ and PHP 8.0+. Tested with WordPress 7.0.2.

3.0.1

Security hardening release. Includes 10+ security improvements. All users should update immediately.

3.0.0

Major security release with rate limiting, CSRF protection, and input sanitization. Backward compatible with previous settings.