https:\/\/github.com\/brokensmile2103\/init-chat-engine<\/a><\/p>\n\nKey Features:<\/strong><\/p>\n\nFrontend Experience:<\/strong>\n- Built with 100% REST API and Vanilla JS\n- No jQuery, no bloat \u2013 blazing fast\n- Fully embeddable via [init_chatbox]<\/code> shortcode\n- Multiple chat rooms via [init_chatbox room=\"...\"]<\/code> \u2013 each room has its own messages, pinned message and limits\n- Guest messaging support (optional)\n- Smart polling system (adaptive 3.5\u201310s based on activity, up to 20s when the chatbox is scrolled out of view)\n- Browser notifications when new messages arrive\n- Scroll-up to load history, scroll-down to auto-scroll\n- Optimistic sending & \"new message\" jump button\n- Clean UI with customizable themes\n- Template override supported (chatbox.php<\/code>)<\/p>\n\nAdministrative Control:<\/strong>\n- Complete Settings Panel<\/strong> - Basic, Security, and Advanced configurations\n- Message Management<\/strong> - Search, view, delete messages with pagination\n- User Moderation<\/strong> - Ban\/unban users by IP or user ID with expiration\n- Rate Limiting<\/strong> - Prevent spam with configurable message limits\n- Word Filtering<\/strong> - Block messages containing prohibited words\n- Statistics Dashboard<\/strong> - View chat activity, user engagement, and trends\n- Cleanup Tools<\/strong> - Automatic and manual cleanup of old messages\n- Custom CSS Support<\/strong> - Full styling customization options<\/p>\n\nSecurity & Moderation:<\/strong>\n- IP-based and user-based banning system\n- Configurable rate limiting (messages per minute)\n- Word filtering with custom blocked word lists\n- Message moderation queue (optional)\n- Automatic cleanup of old messages and expired bans\n- Admin override capabilities<\/p>\n\nMultilingual Ready:<\/strong>\n- Translation-ready with full .pot<\/code> file included\n- Vietnamese translation included\n- Easy to translate to any language<\/p>\n\nPerfect for community-based sites, forums, fanpages, manga readers, SaaS dashboards, customer support, or any interactive chat widget.<\/p>\n\n
Shortcode Attributes<\/h3>\n\n
Shortcode [init_chatbox]<\/code> supports the following attributes:<\/p>\n\n\nheight<\/code> - Set chat height (e.g., height=\"400px\"<\/code>)<\/li>\nwidth<\/code> - Set chat width (e.g., width=\"100%\"<\/code>)<\/li>\ntheme<\/code> - Apply custom theme (e.g., theme=\"dark\"<\/code>)<\/li>\nshow_avatars<\/code> - Override avatar setting (true<\/code>\/false<\/code>)<\/li>\nshow_timestamps<\/code> - Override timestamp setting (true<\/code>\/false<\/code>)<\/li>\ntitle<\/code> - Add custom chat title<\/li>\nclass<\/code> - Add custom CSS classes<\/li>\nid<\/code> - Set custom container ID<\/li>\nroom<\/code> - Chat room name (letters, numbers, -<\/code> and _<\/code>). Leave empty for the default room (the main chat, which keeps all existing messages). Each room has its own messages, pinned message and message limit (e.g. room=\"vip\"<\/code>)<\/li>\nallow_guests<\/code> - Per-room override of the \"Allow guests\" setting (yes<\/code>\/no<\/code>)<\/li>\nmax_messages<\/code> - Per-room override of the \"Maximum Messages\" setting (10\u201310,000)<\/li>\n<\/ul>\n\nExample: [init_chatbox height=\"500px\" title=\"Community Chat\" theme=\"modern\"]<\/code><\/p>\n\nRoom example: [init_chatbox room=\"members\" title=\"Members Lounge\" allow_guests=\"no\" max_messages=\"500\"]<\/code><\/p>\n\nOnly one chatbox per page is supported. Room overrides (allow_guests<\/code>, max_messages<\/code>) are saved when the shortcode is displayed on published content (not in drafts or previews), so use the same attributes everywhere a room is embedded.<\/p>\n\nShortcode [init_chat_stats]<\/code> also accepts room<\/code> to show statistics for a single room (e.g. [init_chat_stats room=\"vip\"]<\/code>); without it, all rooms are counted.<\/p>\n\nFilters for Developers<\/h3>\n\n
This plugin provides filters and actions to allow developers to extend word filtering, message processing, and chat behavior without modifying core files.<\/p>\n\n
init_plugin_suite_chat_engine_word_filter_strategy<\/code><\/strong>
\nModify word filtering strategy (substring<\/code>, word<\/code>, regex<\/code>).
\nApplies to:<\/strong> Message validation
\nParams:<\/strong> string $strategy<\/code>, array $settings<\/code>, string $message<\/code><\/p>\n\ninit_plugin_suite_chat_engine_blocked_words<\/code><\/strong>
\nModify the blocked-words list before validation.
\nApplies to:<\/strong> Message validation
\nParams:<\/strong> array $blocked_words<\/code>, array $settings<\/code>, string $message<\/code><\/p>\n\ninit_plugin_suite_chat_engine_bypass_filter<\/code><\/strong>
\nBypass filtering under custom conditions (VIP, internal users, etc.).
\nApplies to:<\/strong> Message validation
\nParams:<\/strong> bool $bypass<\/code>, string $message<\/code>, WP_User|null $user<\/code>, array $settings<\/code><\/p>\n\ninit_plugin_suite_chat_engine_word_block_hit<\/code><\/strong> (action)<\/em>
\nTriggered when a word filter rule blocks a message.
\nApplies to:<\/strong> Message validation
\nParams:<\/strong> string $blocked_word<\/code>, string $message<\/code>, string $strategy<\/code><\/p>\n\ninit_plugin_suite_chat_engine_enrich_message_row<\/code><\/strong>
\nExtend chat message data (add flags, metadata, user info, etc.).
\nApplies to:<\/strong> Backend DB \u2192 JSON output
\nParams:<\/strong> array $message_row<\/code>, WP_User|null $user<\/code><\/p>\n\ninit_plugin_suite_chat_engine_message_saved<\/code><\/strong> (action)<\/em>
\nFired after a message is stored.
\nApplies to:<\/strong> POST \/send
\nParams:<\/strong> int $message_id<\/code>, string $message<\/code>, int|null $user_id<\/code>, string $display_name<\/code>, string $room<\/code> (added in 1.3.9; ''<\/code> = default room)<\/p>\n\ninit_plugin_suite_chat_engine_ip_headers<\/code><\/strong>
\nChoose which $_SERVER<\/code> keys are trusted (in priority order) when detecting the visitor IP used for bans and rate limiting. Default keeps the existing list (Cloudflare \/ proxy headers first, then REMOTE_ADDR<\/code>). Sites not behind a proxy or CDN can return array( 'REMOTE_ADDR' )<\/code> to prevent spoofed X-Forwarded-For<\/code> headers from bypassing IP bans.
\nApplies to:<\/strong> Ban check, rate limiting, message logging
\nParams:<\/strong> array $ip_keys<\/code><\/p>\n\nLicense<\/h3>\n\n
This plugin is licensed under the GPLv2 or later.
\nYou are free to use, modify, and distribute it under the same license.<\/p>\n\n\n
\n- Upload the plugin to the
\/wp-content\/plugins\/<\/code> directory.<\/li>\n- Activate the plugin through the 'Plugins' menu in WordPress.<\/li>\n
- Configure settings under
Settings \u2192 Chat Engine<\/code>.<\/li>\n- Add the
[init_chatbox]<\/code> shortcode anywhere you want the chatbox to appear.<\/li>\n- Optional: Visit
Chat Engine \u2192 Management<\/code> to moderate messages and users.<\/li>\n<\/ol>\n\n\n\nCan guests send messages?<\/h3><\/dt>\nYes, if enabled in the plugin settings under Basic Settings. Guests will be asked to enter a display name before sending messages.<\/p><\/dd>\n
How do I moderate messages and users?<\/h3><\/dt>\nGo to Chat Engine \u2192 Management<\/code> to view recent messages, ban\/unban users, and see chat statistics. You can search messages, delete inappropriate content, and ban users by IP or user account.<\/p><\/dd>\nDoes it support real-time messaging?<\/h3><\/dt>\nThis plugin uses REST API with smart polling (3.5-10 second intervals) for broad compatibility. No WebSocket setup required, works on any hosting.<\/p><\/dd>\n
How many messages are stored?<\/h3><\/dt>\nConfigurable in settings (default: 1000 messages). Old messages are automatically deleted when the limit is reached. You can also set up automatic cleanup based on age.<\/p><\/dd>\n
Can I customize the chat appearance?<\/h3><\/dt>\nYes, multiple ways:\n- Use the Custom CSS field in Advanced Settings\n- Override the template by placing chatbox.php<\/code> in your theme's init-chat-engine\/<\/code> folder\n- Use shortcode attributes for basic styling\n- Disable plugin CSS entirely and use your own<\/p><\/dd>\nHow does the ban system work?<\/h3><\/dt>\nAdministrators can ban users by IP address or user account from the Management panel. Bans can be temporary (with expiration date) or permanent. Banned users see a clear message explaining their restriction.<\/p><\/dd>\n
Can I limit message frequency?<\/h3><\/dt>\nYes, use the Rate Limiting setting to control how many messages users can send per minute (1-100 messages). This helps prevent spam and abuse.<\/p><\/dd>\n
Is it translation-ready?<\/h3><\/dt>\nYes, the plugin is fully translation-ready with Vietnamese translation included. All text strings use proper WordPress internationalization functions.<\/p><\/dd>\n
Can I have several chat rooms?<\/h3><\/dt>\nYes (since 1.3.9). Add the room<\/code> attribute: [init_chatbox room=\"vip\"]<\/code>. Rooms are created automatically from the shortcode and every room is isolated: messages, pinned message and message limit. The room name is signed by the server, so visitors cannot post into rooms that don't exist on your site. Bans, rate limiting, word filtering and account age rules are shared by all rooms. Manage rooms under Chat Engine \u2192 Management<\/code> (room filter on Recent Messages and Statistics, plus a Chat Rooms overview).<\/p><\/dd>\nHow do I backup chat data?<\/h3><\/dt>\nChat messages are stored in your WordPress database in the wp_init_chatbox_msgs<\/code> table. Use any WordPress backup plugin or database backup tool.<\/p><\/dd>\n\n<\/dl>\n\n\n1.3.9 \u2013 October 2, 2026<\/h4>\n\n\n- Fix: open chat tabs could get stuck and stop receiving new messages until the page was reloaded (polling kept requesting the same
after_id<\/code>), on sites with a persistent object cache such as Redis or Memcached. A slow poll request that read the database just before a new message was sent could write its outdated \"latest message ID\" into the shared cache after<\/em> the new message had cleared it, so every client already at that ID was told there was nothing new. Frontend cache entries are now tagged with a generation token that changes on every message change, so a late write can never hide newer messages. Reproduced and verified fixed against a real Redis object cache under concurrent requests<\/li>\n- Fix:
GET \/messages<\/code> and GET \/user-status<\/code> now send no-cache<\/code> headers (plus X-LiteSpeed-Cache-Control: no-cache<\/code>), and the chat script fetches with cache: 'no-store'<\/code>, so page caches \/ CDNs (LiteSpeed Cache \"Cache REST API\", Cloudflare, Varnish, Nginx FastCGI cache) and the browser can no longer serve an old empty polling response for the same URL<\/li>\n- Fix: a request that hung (e.g. after the computer woke from sleep or switched networks) blocked all later polls forever because polling skips while a request is still pending. Requests now time out after 20 seconds and polling resumes automatically<\/li>\n
- Performance: \"no new messages\" polls are cached safely again (1.3.7 had to disable this to avoid the race above): idle polls on a site with a persistent object cache no longer touch the database at all<\/li>\n
- New: multiple chat rooms. Add
room=\"...\"<\/code> to [init_chatbox]<\/code> to create an isolated room with its own messages, pinned message and message limit. Existing messages stay in the default room, so current chatboxes are unchanged (the id<\/code> attribute is still only the HTML container ID)<\/li>\n- New: room names are signed (HMAC) by the server and printed into the page, so the REST API only accepts rooms that come from a shortcode on your site \u2014 nobody can create or spam hidden rooms. Works with page caching<\/li>\n
- New: per-room shortcode overrides
allow_guests=\"yes|no\"<\/code> and max_messages=\"...\"<\/code> (only saved from published content, so contributors cannot change a room's rules through drafts or previews)<\/li>\n- New: Management \u2192 Recent Messages has a room filter and a Room column; Management \u2192 Statistics can be filtered by room and lists all rooms (message count, last activity, guest access, message limit) with a \"Delete Room Messages\" action<\/li>\n
- New:
[init_chat_stats room=\"...\"]<\/code> shows statistics for a single room<\/li>\n- New: the \"Maximum Messages\" limit and the daily cleanup now apply per room<\/li>\n
- Developer:
init_plugin_suite_chat_engine_message_saved<\/code> now receives the room as a 5th argument; GET \/messages<\/code> and POST \/send<\/code> responses include room<\/code><\/li>\n- Database: adds a
room<\/code> column and a (room, is_deleted, id)<\/code> index to the messages table. The upgrade runs automatically on the first request after updating (also on the frontend, not only in wp-admin) and does not touch existing data<\/li>\n- New translatable strings for rooms (Vietnamese translation updated)<\/li>\n<\/ul>\n\n
1.3.8 \u2013 October 1, 2026<\/h4>\n\n\n- Fix: the Rate Limiting<\/strong> setting was ignored \u2014 the limit was read from a legacy option the Settings page no longer writes to, so every site was silently limited to the default 10 messages\/minute regardless of what the admin configured. The saved value is now honored (sites that never saved Security settings keep the previous default of 10)<\/li>\n
- Fix: the daily cleanup cron (and the \"Run Cleanup Now\" button) had the same problem with Maximum Messages<\/strong> and Automatic Cleanup<\/strong> days \u2014 it always used the defaults (1000 \/ 30 days). It now uses the configured values<\/li>\n
- Fix: maximum message length was counted in bytes instead of characters, so Vietnamese \/ accented \/ emoji messages were rejected well before the configured limit even though the on-screen counter still showed room left. Length is now counted in characters, matching the counter and the setting's description<\/li>\n
- Fix: using a custom container ID (
[init_chatbox id=\"...\"]<\/code>) stopped the chat from loading at all \u2014 the script only looked for the default init-chatbox-root<\/code> ID<\/li>\n- Fix: on sites using the Plain<\/strong> permalink structure (REST URLs of the form
index.php?rest_route=...<\/code>) the chat never loaded any messages \u2014 the script appended its parameters with a second ?<\/code>, producing an invalid URL (HTTP 404). Query parameters are now appended correctly for both permalink styles<\/li>\n- Fix: Custom CSS containing
><\/code> child selectors or quotes (e.g. content: \"...\"<\/code>, font-family: \"...\"<\/code>) was broken by HTML-escaping on output. CSS is now output intact while still stripping HTML tags and neutralizing <\/<\/code> so it cannot break out of the <style><\/code> tag<\/li>\n- Fix: after Delete All Messages<\/strong> (or deleting the pinned message from the Management page \/ moderation endpoint), the pinned banner kept showing the deleted message because it renders from a stored snapshot. Admin deletions now unpin it too (automatic trimming of old messages by the Maximum Messages limit does not unpin)<\/li>\n
- Fix: unbanning by user ID \/ IP (without a ban ID) did not clear the ban cache, so the user could stay blocked until the cache expired; cached temporary bans also never outlive their expiry time now<\/li>\n
- Fix: validation error for Minimum Account Age<\/strong> (over 3650 days) was never displayed because it was added after the settings error notice had already been registered<\/li>\n
- Fix: the \"has messages\" flag used to size the empty chatbox was cached for a day and never invalidated, so a freshly used chat could keep its \"empty\" layout<\/li>\n
- Fix: the admin message list could show stale data for up to 5 minutes (new messages missing, wrong page size after changing Screen Options) on hosts with a persistent object cache. The list cache is now versioned and invalidated on every message change<\/li>\n
- Fix: uninstalling the plugin left the
init_chatbox_stats<\/code> and init_chatbox_banned<\/code> tables, settings options, the cleanup cron event and per-user Screen Options behind. Uninstall now removes all plugin data<\/li>\n- Security: hardened HTML escaping in the chat script \u2014 the previous helper did not escape quotes, so a crafted display name or same-site link inside a message could break out of an HTML attribute (stored XSS). Quotes are now escaped everywhere user content is placed into the chat markup<\/li>\n
- Security: the
theme<\/code> shortcode attribute is now restricted to letters, numbers, -<\/code> and _<\/code> before being used in template \/ stylesheet paths, preventing path traversal (e.g. theme=\"..\/..\/..\"<\/code>)<\/li>\n- Security:
GET \/user-status<\/code> no longer exposes the full ban record (banning admin's user ID, stored IP address); ban_info<\/code> now contains only reason<\/code>, banned_at<\/code> and expires_at<\/code><\/li>\n- Security: added the
init_plugin_suite_chat_engine_ip_headers<\/code> filter so sites not behind a proxy\/CDN can trust only