Inbox – Private Messaging, Guest Messages & Help Desk

Inbox is a messaging system for your own WordPress site. It is not an email client and does not connect to Gmail or other mailboxes. It lets the people on your site talk to each other, and lets visitors reach them, without anyone leaving WordPress. It works on any site, and supports WooCommerce vendors and customers automatically when WooCommerce is active.

What you can do

• Private messages between members. Students, customers, vendors, staff, anyone with an account.
• Messages from visitors. People who aren’t logged in can write to a member or to your support team. Visitor messages arrive in a separate Requests folder, so strangers never clutter the main inbox.
• Reply to visitors. Visitors confirm their email address first, then follow the conversation through a private link and get an email when someone replies.
• Stay in control. Every member can switch off visitor messages, and block or report a sender. Admins can switch visitor messages off for the whole site.
• A real inbox. Inbox, Requests, Sent, Archived and Trash folders, read/unread, search, and email notifications.
• Support departments. Create departments, assign staff, and put a help form on any page. Staff can close and reopen conversations.
• Announcements. Send or schedule a message to all members or to one role.
• Blocked words. Reject messages that contain words you choose.
• WooCommerce. A “Message the seller” button on product pages and a Messages link in My Account.
• Shortcodes. [inbox], [inbox_help] and [inbox_contact]. Inbox and Help pages are created for you on activation.

Security and privacy

• Visitor forms are protected by a honeypot, a signed timing check, rate limits, email confirmation and an optional CAPTCHA.
• Requests, replies and settings are checked with nonces and capability checks. Input is sanitized, output is escaped, and queries are prepared.
• Message text is plain text only. Nothing a user writes is ever rendered as HTML.
• Visitor links are secret tokens. Only a hash is stored in the database.
• A member’s email address is never shown to visitors.
• Administrators can’t read private member conversations unless you turn that on in Settings. Support requests are always readable by staff.
• Choose to delete all data when the plugin is uninstalled.

External services

Inbox does not contact any external service by default. If you choose a CAPTCHA provider under Inbox > Settings, the plugin loads that provider’s script on pages that show a visitor form, and sends the visitor’s CAPTCHA response (and IP address) to the provider to check it. Providers you can choose, with their terms and privacy policies:

• Cloudflare Turnstile: terms, privacy policy
• hCaptcha: terms, privacy policy
• Google reCAPTCHA: terms, privacy policy

Good to know

• Live chat and file attachments are not included.
• Version 2 starts with a clean slate. Conversations from version 1.x are not imported (they are left untouched in your database).