Name: Plexvia Connector
Author: plexvia

Plexvia Connector is the official plugin that links your WordPress site to your Plexvia account. It does four things, all from one clean settings screen:

Website verification — prove you control this domain so Plexvia can work with your site. The plugin adds the required verification meta tag to your site’s <head> and triggers verification with one click.
Chat widget — add a premium, polished AI chat experience to every page. The widget answers visitors instantly from your Plexvia knowledge and hands off to a teammate when a conversation needs a person. It is off until you switch it on.
Content sync — two separate, separately optional things. Automatic sync keeps your AI’s answers in step with your content’s lifecycle from the moment you switch it on: publish or update a page and Plexvia re-reads it; move it to draft and its answers are hidden; delete it and they’re archived. Sync existing content now is a one-time button that reads the pages you have already published. Neither happens on its own — you can run the one-time sync without ever switching automatic sync on, and running it does not switch it on. Only the page’s URL and the change are sent; Plexvia fetches the public page itself, and no content is pushed from WordPress.
Connection maintenance — a daily background task checks that this site’s connection to Plexvia still works and retires your stored account session once this website has its own connection credential. It calls the Plexvia API and nothing else.

Built for trust

The chat widget is off by default and only loads when you enable it and connect a chat agent.
Content sync is off by default. Installing the plugin, connecting your Plexvia account and choosing a business read nothing from your site. Automatic lifecycle sync starts only when you switch it on, and your already-published pages are read only when you click Sync existing content now — each is its own deliberate choice, and neither implies the other.
Your Plexvia account password is never stored. Signing in gives this website its own connection credential — limited to this one business, and to keeping your content and domain verification in step — and that is what the site runs on. Your account session is retired a day after that, so an account-wide credential is not left sitting in your database for the life of the install.
Stored credentials are protected with AES-256-GCM at rest when the server provides the required OpenSSL support. If authenticated encryption is unavailable, the plugin clearly warns administrators that stored credentials are only encoded rather than encrypted.
Admin-only secrets are never placed in your public pages. Only the public chat key is sent to the browser.
Every admin action is protected by capability checks and nonces. All input is sanitized; all output is escaped.

Design

The widget follows a calm, modern aesthetic: soft surfaces, generous spacing, a glass header, refined typography, elegant motion, and accessible contrast. It is keyboard-friendly, screen-reader-labelled, respects reduced-motion preferences, and is fully responsive on mobile. Its styles are fully self-contained, so it looks the same on any theme.

External services

This plugin connects to the Plexvia API and the Plexvia real-time service to provide its features. Both are required for the plugin to function. The service is provided by Plexvia (https://plexvia.com); see the Plexvia Terms (https://plexvia.com/terms) and Privacy Policy (https://plexvia.com/privacy).

What is sent, and when:

When you connect (administrator only): your email and password are sent once to the Plexvia API (api.plexvia.com) to sign you in; the password is not stored in WordPress. The plugin then asks Plexvia for a connection credential belonging to this website and stores that, encrypted. Setup steps you take on the settings screen — listing your businesses, listing chat agents, creating the widget’s public chat key — use your account session while you are signed in. Your account session is stored, encrypted, until it is retired.
When the plugin verifies your website (unattended): your business ID and this website’s own connection credential are sent to the Plexvia API, which then fetches this site’s public home page to look for the verification meta tag. That credential can do two things and nothing else: keep this site’s ingested pages in step, and prove this domain is yours. It cannot read your knowledge base, open conversations, or create other credentials, and you can revoke it from your Plexvia dashboard at any time.
When you turn on automatic content sync: each time you publish, update, draft, or delete a public page or post, your server sends that page’s URL and the change (publish, draft, or archive) — along with your business ID and this website’s connection credential — to the Plexvia API (api.plexvia.com) so Plexvia can re-read, hide, or archive the page’s knowledge accordingly. Nothing is sent automatically while that setting is off.
When you click Sync existing content now (administrator only): the URLs of your currently published pages and posts are sent the same way, once, in background batches. This is a separate, explicit action: it works whether or not automatic sync is on, and it does not turn automatic sync on. In both cases no page content is sent from WordPress — Plexvia fetches the public page itself — and password-protected, private, draft and otherwise non-public content is skipped.
When the chat widget is enabled: your visitors’ browsers open a real-time WebSocket connection to Plexvia (wss://api.plexvia.com) using your public chat key, and the messages a visitor types in the widget are sent to Plexvia to generate a reply. A visitor identifier and the local chat transcript are stored in the visitor’s browser (localStorage) so a conversation can resume across page loads; nothing is written to your database. The widget also shows a legal notice beside the message box before anything is sent, with links to Plexvia’s Chatbot User Terms of Use and Privacy Policy — the documents that govern the visitor. Those links point to plexvia.com, so enabling the widget places two external links on your public site. The current version of those documents is supplied by Plexvia when the connection opens, and an identifier for the version shown is sent with the visitor’s first message so Plexvia can record which notice was displayed. That identifier is an opaque version string — it contains nothing about the visitor.
Inside a chat reply (visitor-facing): when an answer contains a phone number, an address, or a product from your Plexvia knowledge base, the widget renders it as a tappable card. An address card is a plain link to Google Maps (https://www.google.com/maps) — no map is embedded, no API key is used, and nothing is sent to Google unless the visitor taps it. A product card may show a product image, which the visitor’s browser loads from wherever that image is hosted in your own catalogue; the request carries no referrer. Only http/https links and image sources are ever rendered.
During daily connection maintenance: if the site is connected, the plugin calls the Plexvia API to check that its connection credential still works, to issue one if this site does not have one yet, and — once it does — to retire the stored account session, which is no longer needed. A site that does not yet have its own credential has its account session refreshed instead. These are the same authenticated Plexvia API endpoints the plugin already uses; no separate report is sent, and no other host is contacted.
For server-side Plexvia API requests: the connector’s HTTP User-Agent names the plugin and its version (PlexviaConnector/1.0.0). Your site’s address is not included.