Aiwend Wordpress Plugin - Rating, Reviews, Demo & Download
Plugin Description
Aiwend lets you add a chat assistant to your site that answers visitors’ questions from content you choose, cites the sources it used, and stops when the limits you set are reached. You bring your own AI provider account (“bring your own key”); Aiwend has no server and no subscription. Developed by Erfan Teymouri.
This is a beta release (0.8.0). The connections to OpenAI, Anthropic and Google Gemini were checked end to end once with real provider accounts using sample content only, and are otherwise tested with recorded sample responses. Providers change their services without notice, so expect rough edges, try Aiwend on a staging site first, and set a spending limit at your AI provider as well as in Aiwend.
The six modules
All six modules are included at no charge and all six are switched off after activation; you turn on only what you want (Aiwend > Settings > Modules).
- Chat: assistants with their own name, instructions, appearance, AI connection and model, shown inline (block “Aiwend Chat” or shortcode
[aiwend_chat bot="ID"]) or as a floating launcher. Visitors can stop an answer, start over, delete their conversation and rate answers. - Knowledge: published, public posts and pages and uploaded TXT or Markdown files. Answers come only from sources you attach to the assistant and mark Public, and each answer lists its sources. Search matches words; there is no meaning-based search.
- Content Studio: you write a brief and review a proposed post or page draft; it is saved only when you press Save as draft.
- WooCommerce AI (needs WooCommerce): text for simple products. You choose the fields, review the proposal and confirm; price, SKU, stock, status and other fields are never touched.
- AI Forms: an inquiry form (
[aiwend_form id="N"]). Messages are stored on your site for administrators; nothing goes to an AI provider unless an administrator presses Analyze on one message. Aiwend sends no emails. - MCP: an optional read-only endpoint for AI apps that you connect with an application password. It offers nothing until you tick a tool, and it cannot change anything.
Also included: connections to OpenAI, Anthropic and Google Gemini with your own keys (encrypted on your site), a site usage limit, per-conversation and per-visitor daily limits, a pause switch, and an administrator view of conversations with export and delete.
Not available
Meaning-based (embedding) search, human handoff, order or customer assistants, automatic emails, tools that change the site through MCP, and OAuth for MCP are not part of this plugin.
This edition does not read PDF files; add that content as a post, a page or a text file.
Deactivation and uninstall
- Deactivating stops scheduled jobs and removes the chat widget and routes; all Aiwend data stays in the database.
- Deleting the plugin keeps all data by default (tables wp_aiwend_*, options aiwend_*), so reinstalling restores everything.
- To remove everything on delete, turn on Aiwend > Settings > Privacy > “When the plugin is deleted” > permanently delete (you must type DELETE). It then removes, for that site, the tables, options, capabilities and scheduled job, and the key file when no site on the installation keeps its data (saved provider keys then become unrecoverable). It cannot be undone.
- Your posts, pages, media and users are never deleted. AI providers keep their own records.
Requirements
Minimums: PHP 8.2 with the json, sodium and mbstring extensions; WordPress 7.0 or newer (tested on 7.0.7 and 7.1.3); InnoDB. Tested with PHP 8.2 and 8.3 and WordPress 7.0.7 and 7.1.3, on Linux (Apache and nginx) and Windows. PHP 8.4 or newer has not been tested.
Database versions: Aiwend supports MySQL 8.0 or newer and MariaDB 10.11 or newer. The suites were run on MySQL 8.0.46 and 8.4.11 and MariaDB 10.11.14 and 11.4.13 (unit tests with real-database variants, the integration suite, and install and uninstall checks); other patch versions of those series are expected to work. Newer series (for example MySQL 9 or MariaDB 11.8) were not individually verified; no problem is known and Aiwend shows no warning for them. Servers older than the minimum are not supported and Aiwend then shows a notice. MySQL 8.0 reached upstream end of life in April 2026: keep it patched through your host or move to 8.4. Aiwend never blocks activation because of the database version.
Other requirements: You need an API key from OpenAI, Anthropic or Google AI Studio with billing set up at the provider; usage is charged by the provider to your account, separately from any ChatGPT, Claude or Gemini app subscription.
External services
Aiwend contacts an AI provider only after an administrator connects their OWN account, and only for the actions below. Nothing is sent when settings are opened or saved, no provider is contacted by default, and Aiwend never switches to another provider on its own. Aiwend has no server and sends nothing to its author. It loads no scripts, styles, fonts or images from other servers.
- OpenAI (https://api.openai.com). “Check access” sends your API key to the model list endpoint. A chat answer sends the assistant’s instructions, the visitor’s conversation and the text excerpts of the sources used. “Send test message” sends one fixed test message. API customer terms (Services Agreement): https://openai.com/policies/services-agreement/ How API data is handled (Data controls in the OpenAI platform): https://developers.openai.com/api/docs/guides/your-data OpenAI’s general privacy policy, which covers its websites and consumer services and does not govern API customer content: https://openai.com/policies/privacy-policy/
- Anthropic (https://api.anthropic.com): the same purposes. Terms: https://www.anthropic.com/legal/commercial-terms Privacy: https://www.anthropic.com/legal/privacy
- Google Gemini API (https://generativelanguage.googleapis.com): the same purposes (Google AI Studio keys; Vertex AI is not supported). Terms: https://ai.google.dev/gemini-api/terms Privacy: https://policies.google.com/privacy
- Content Studio and WooCommerce AI send your brief or the selected product fields and the instructions to your connected provider only when someone starts a generation. AI Forms sends one stored message only when an administrator presses Analyze; visitors’ submissions never reach a provider by themselves.
- MCP makes no outbound request. It lets an application that you authorise with an application password read the data described below from your site; that application and its AI service are not controlled by Aiwend.
- Your provider may charge your account for these requests and may keep its own records; providers may handle data differently on free and paid plans. Aiwend’s unit budget limits what Aiwend sends; it is not your provider’s invoice, and local deletion cannot erase a provider’s copy.
- Answers are streamed through the WordPress HTTP API (wp_remote_post). These requests are HTTPS only, verify certificates, do not follow redirects, contact only the hosts above, and obey WP_HTTP_BLOCK_EXTERNAL, WP_ACCESSIBLE_HOSTS, the WordPress proxy constants and the
pre_http_requestfilter. Theaiwend_streaming_enabledfilter (return false) switches streaming off. Stop: when a visitor presses Stop, Aiwend immediately stops showing and processing the answer, keeps the part already received and closes the connection to the AI provider (through the WordPress http_api_curl action). Whether the provider stops generating or billing once its client has gone is up to the provider, so Aiwend records a stopped answer as “usage unknown” and holds its reservation as uncertain instead of settling it. - Code for an OpenAI embeddings request exists but is switched off and cannot run in this build; meaning-based search sends nothing.
Privacy
- Consent and visitor notice. Nothing leaves your site until an administrator connects their own provider account and turns on a module. The chat shows visitors a short notice under the message box that answers can be wrong and that messages and selected source excerpts are sent to the configured AI provider. As the site owner you decide whether that is enough for your visitors and your local law, and you should mention the provider in your own privacy policy.
- What is stored. Chat messages and sessions are kept in your database and deleted after 30 days by default (Aiwend > Settings > Privacy). Audit events record actions and outcomes, not message content (30 days by default). Usage records (request IDs and unit counts, no message content) are kept for spending control. Knowledge text and its index are kept until you delete the source; uploaded files are stored as text in the database, not in the uploads folder.
- Cookie. A visitor’s chat uses a random cookie (aiwend_chat_, HttpOnly, SameSite=Strict, up to 24 hours); only a hash of it is stored.
- Abuse limits. Aiwend uses a keyed hash of the visitor’s network address (an IPv6 address as its /64 network), never the address itself, for message and conversation limits (kept for minutes) and for the daily limit (a hash that changes every day, kept for about two days). Signed-in visitors are counted by account number. Administrators see only counts.
- Providers. When an assistant answers, the data described under “External services” leaves your site. The
store:falsesetting on OpenAI requests disables response storage but does not promise zero retention. Closing the stream does not prove that remote processing or billing stopped. - AI Forms. A submission stores the optional name, email address, topic and message, a creation and expiry time and, if analysed, the administrator’s AI result. Submissions are deleted after 30 days by default (1 to 365 days) and an administrator can delete any message at once. No IP address, user agent or user ID is stored.
- MCP. Requests are logged as tool name and outcome only, never arguments, results or credentials. Tools return the site name and language, a list of published pages or posts, and the text of one published, public, non-password-protected page or post; text you do not want an AI service to read should not be published.
- Aiwend adds text to the WordPress privacy policy guide and supports the WordPress personal data export and erasure tools (conversations of signed-in users, AI Forms by email address). Guests can delete their own conversation in the chat. These controls alone do not make a site compliant with any privacy law.
Source code
All PHP, JavaScript and CSS in this plugin is shipped as written: nothing is minified, compiled or generated, and there is no build step for it. The only bundled library, symfony/polyfill-mbstring, is installed with Composer from composer.json (composer install –no-dev) and its unmodified source is in the vendor folder.
License
Aiwend’s own code and the Aiwend symbol images (assets/brand/aiwend-symbol-64.png, -128.png, -256.png) are licensed under the GNU General Public License, version 3 or (at your option) any later version (SPDX: GPL-3.0-or-later); the full text is in the LICENSE file. Third-party components keep their own licenses and notices, listed in THIRD-PARTY-NOTICES.txt (symfony/polyfill-mbstring is MIT).
Third-party notices
See THIRD-PARTY-NOTICES.txt.
Screenshots
No screenshots provided
