NeccoSpeak – AI Chatbot & Voice Chat

Description

NeccoSpeak turns your WordPress site into something visitors can simply talk to: an AI agent that answers questions 24/7 by text or voice, guides people to the right page, and runs entirely on your own OpenAI API key.

No SaaS, no extra account, no monthly fee, and no server run by us. It needs nothing but WordPress and your own OpenAI API key. You pay OpenAI directly and stay in control of your costs and your data.

Voice chat: talk, don’t type

AI voice chat sets NeccoSpeak apart, and it is on by default. Visitors ask questions hands-free and hear the answer spoken back — in effect, your website gains a voice assistant — a natural fit for accessibility, mobile users, and anyone who would rather speak than type. Under the hood, the visitor’s browser connects directly to the OpenAI Realtime API over WebRTC using a short-lived token issued by your server; your real API key never reaches the browser. Voice requires HTTPS and browser microphone permission.

What can you use it for?

• 24/7 FAQ and support – answer common questions (opening hours, pricing, services) around the clock.
• Online stores – let shoppers ask about shipping, returns, and store policies on the spot, instead of hunting through pages.
• Multilingual visitors – OpenAI models typically reply in the language the visitor writes in, with no extra configuration.
• Blogs and content sites – give readers a way to ask questions instead of leaving.
• Client sites – agencies and freelancers can deploy it without managing yet another SaaS account; each client brings their own key and owns their own billing and data.

You decide who the chatbot is: describe its role, your business, opening hours, policies, and tone on the AI settings tab, and it answers accordingly.

Why NeccoSpeak?

• Self-contained – no third-party SaaS involved; data flows only between your server, the visitor’s browser, and OpenAI, unless you reference an external URL in the optional Additional CSS box (see “External Services” below).
• Secure by design – your API key is stored encrypted with AES-256-CBC, never sent to the browser, and masked in the admin screen.
• Zero footprint until configured – while disabled or without a key, the widget is not loaded and visitors trigger no external communication at all. (This does not apply if the Additional CSS box references an external image/font URL — see “External Services”.)
• Budget protection – per-IP rate limits plus site-wide caps (hourly and daily for chat, daily for voice) keep bots and abusive visitors from running up your OpenAI bill.
• No update needed for new models – choose the model from the list of models available to your key, fetched live from OpenAI. New OpenAI models that support the Chat Completions API show up in that list without a plugin update.

Features

• Text and voice chat in one widget
• Display rules: all pages, only specific URLs, or exclude specific URLs
• Customizable title, welcome message, and brand color
• Model selection from the live list of models available to your key
• Configurable role, goals, company information, FAQ, tone, and response rules for the assistant
• Per-IP and site-wide rate limits to control cost

Cost control

Visitors’ chat usage is billed to your own OpenAI account, so NeccoSpeak ships with brakes built in: a per-IP, per-minute limit plus site-wide caps (hourly and daily for text chat, daily for voice sessions). When a cap is hit, further requests are declined with a temporary error until the limit window resets — so your bill stops growing.
Defaults: chat 10/min per IP plus 200/hour and 1,000/day site-wide; voice 10/min per IP plus 200/day site-wide.

Site content and tools (optional)

These settings let you choose how much of your own site the assistant can work with. Per-page guidance and the page directory are on the Conversation flow tab, the tools are on the Model & advanced settings tab, and site content search is on the AI settings tab’s Content sync card.

• Per-page instructions (on by default) – adds a “NeccoSpeak” box to every post/page editor where you can set extra instructions, a welcome-message override, and a widget show/hide switch for that one page.
• Read-only tools (on by default) – let the assistant search this site and look up page details, in both text chat and voice conversation. Each individual tool also has to be enabled with its own checkbox before it runs. With GPT-5.6 and later models, text chat does not use these tools; voice conversation is not affected.
• Page directory (optional) – gives the assistant a list of your published pages so it can point visitors to the right one. In both voice conversation and text chat, the assistant can also open that page in the visitor’s browser when asked. With GPT-5.6 and later models, text chat only points to the page and does not open it. Links the assistant produces are checked against your own site, and links to pages that do not exist are removed automatically.
• Current date and time – always supplied to the assistant in your site’s own timezone, with no setting needed.
• Site content search (optional) – stores excerpts of your posts and pages in the plugin’s own database table so the assistant can quote your content directly, in both text chat and voice conversation. No external service is used for the indexing or the search.

The two optional features (page directory and site content search) stay off until you turn them on, and none of these features contact any additional external service.

In voice conversation, the search and page lookup requests go from the visitor’s browser to your own site, and the results are passed on to OpenAI as part of the voice conversation (see “External Services” below).

Terms and disclaimer

• No warranty – This plugin is provided free of charge as open source software (GPLv2 or later) on an “as-is” basis, without warranty of any kind, express or implied. Because it is distributed free of charge, the developer (neccos) assumes no obligation for support, SLA, or continued availability.
• Your OpenAI account – The plugin runs with your own OpenAI API key, and use of the AI is subject to OpenAI’s terms and policies. Usage fees are billed by OpenAI directly to your own account. No developer-operated server or service exists, and the developer is not involved in any contract, billing, or service matters with OpenAI.
• Data flow – Chat text and audio are sent to OpenAI with your key and processed under OpenAI’s terms. They are sent only to OpenAI, and the developer (neccos) never receives this data. Everything the plugin stores within WordPress is administrator-entered settings (the API key is encrypted) plus operational data such as rate-limit counters and the audit log, all removed on uninstall (see “Data stored on your site” below for details).
• Your responsibilities – As the site owner, you are responsible for: (1) complying with OpenAI’s terms, (2) disclosing to your visitors that their input is sent to OpenAI and obtaining any consent required by applicable law such as GDPR, and (3) maintaining your own privacy policy and related documents. Please also advise users not to enter sensitive information in chat or voice.
• AI responses – The accuracy, legality, and usefulness of AI-generated responses are not guaranteed. Use of this plugin and of AI responses is at the sole risk of the site owner and end users.

External Services

This plugin communicates with the external service OpenAI API (api.openai.com) to generate AI responses. This is a core feature of the plugin, and communication occurs when the AI chat / voice features are used. Voice conversation is a direct connection (WebRTC) to the OpenAI Realtime API, and this plugin does not use a STUN/TURN server by default (no additional communication to third-party servers occurs).

When the optional “Link check” setting is on, the plugin also makes a request to this site’s own host — never to any third party — solely to confirm that a link the assistant produced actually points to a real page before showing it to a visitor. Every outbound request (to OpenAI or to this site’s own host) passes through a single allow-list that rejects private and link-local IP addresses after DNS resolution; a request to this site’s own host is exempt from that IP check only, so sites behind Docker, a reverse proxy, or on an intranet keep working. The optional site content search, the optional tools, and the optional Contact Form 7 hand-off contact no external service at all — they run entirely on your own server and inside the visitor’s own browser tab.

OpenAI API

• Destination endpoints:
  • https://api.openai.com/v1/chat/completions (generating text chat responses; via the PHP proxy)
  • https://api.openai.com/v1/realtime/client_secrets (issuing a short-lived token for voice conversation; PHP → OpenAI)
  • https://api.openai.com/v1/realtime/calls (establishing the WebRTC session for voice conversation; sent directly from the browser to OpenAI)
  • https://api.openai.com/v1/models (retrieving the list of available models; only when an administrator opens the Model & advanced settings or Voice settings tab, cached for 6 hours; PHP → OpenAI)
• Data sent (text chat): the message text entered by the visitor in the chat box, the conversation history, the instructions built from your AI settings (plus, when enabled, per-page guidance, the page directory, site content excerpts, and tool results), the model name in use, and the temperature and maximum response length (defaults 1.0 and 800 tokens). These are sent to OpenAI via the PHP proxy at the moment the visitor sends a message. When server-side masking is on (PII protection on the Security tab; on by default for new installations, while existing sites keep their current setting), the selected types of personal information (email addresses, phone numbers, credit card numbers) in the visitor’s messages are replaced before sending. Any run of 8 to 15 digits is treated as a phone number, so some dates or order numbers may be masked too. The assistant’s own messages are not masked.
• Data sent (model list retrieval): only when an administrator (manage_options capability) opens the Model & advanced settings or Voice settings tab and no cached list is available, a request is made from the server side (PHP) to OpenAI using the API key for authentication. Only the authentication credential is sent; no chat text or visitor data is sent. The response (a list of model IDs) is cached temporarily on the server side. This retrieves model metadata and incurs no OpenAI token billing. The API key is never handed to the browser.
• Data sent (when voice conversation is enabled): in addition to the short-lived token issuance request (PHP → OpenAI), which carries the voice session’s instructions built from your settings, the visitor’s microphone audio is sent directly from the browser to OpenAI over WebRTC. Audio is sent from the moment the visitor starts a voice conversation. Text typed while in voice mode, and the results of the voice assistant’s site search, page lookup, and site content search (page titles and excerpts, without URLs), are also sent from the browser to OpenAI over the same connection. Those lookups are requests from the visitor’s browser to your own site’s /neccospeak/v1/tool REST endpoint, which never contacts OpenAI or uses your API key, and is rate limited (30 per minute per IP and 2,000 per day site-wide). Blocked words and server-side PII masking do not apply to voice mode; only the search keywords the voice assistant passes to these tools are checked.
• When data is sent: communication only occurs when a visitor sends a message or starts a voice conversation. When the plugin is not configured (disabled or no key set), no communication occurs at all.
• Purpose: to generate and return an AI response (text or voice) to the input.

Data sent to OpenAI is subject to OpenAI’s terms and policies. Please be sure to review them before use.

• Terms of use: https://openai.com/policies/terms-of-use/
• Privacy policy: https://openai.com/policies/privacy-policy/
• API data usage policies: https://openai.com/policies/api-data-usage-policies/

Additional CSS box (optional)

The Additional CSS box on the Widget settings tab (requires the “unfiltered_html” capability to edit) intentionally allows url(https://…) and @font-face { src: url(https://…) } so administrators can reference their own hosted images/fonts. As a result, if an administrator adds such a rule, every front-end page view may cause the visitor’s browser to fetch that resource from the third-party host referenced in the CSS. This is entirely administrator-controlled: the plugin ships with no Additional CSS by default and reaches no third-party host unless an admin explicitly adds one.

Data stored on your site (no external service)

When “Restore conversation” is enabled, the conversation is temporarily saved in the visitor’s own browser (sessionStorage) so it survives a page navigation within the same tab; it is cleared when the tab is closed. When the “First-open modal” disclaimer is enabled, only a true/false “acknowledged” flag is saved (in localStorage or sessionStorage, depending on the setting). Neither of these is sent to any server, and neither stores any information that identifies the visitor.

In your own WordPress database. The plugin can also keep operational records in four of its own database tables on your server. Nothing here is ever transmitted anywhere — not to the developer, not to OpenAI, not to any third party — and every table is dropped when you uninstall the plugin.

• Settings audit log (on by default): which setting an administrator changed, when, and by whom. API keys and Additional CSS are recorded as redacted placeholders, never as their real values. Entries older than 90 days are deleted.
• Settings version history (always on): up to the 30 most recent snapshots of your settings so you can compare and roll back — the API key is never included in a snapshot, and rollback is one click from the Change history tab.
• Token usage totals (on by default): per day, per model — request counts and token counts recorded from the API responses. It contains no visitor data of any kind.
• Anonymous usage events (off by default): counts of widget opens, messages, voice starts, and CTA clicks.
• Site content index (off by default): when the optional site content search is turned on, excerpts of your own published posts and pages are split and stored in the plugin’s own database table so the assistant can quote them. Nothing here is ever sent anywhere except, when actually quoted in an answer, to OpenAI as part of that answer’s prompt — the same way any other part of the prompt is sent.

No IP addresses, no cookies, no visitor identifiers are ever stored in any of these tables. Usage events are grouped by a random value that lives only in the visitor’s own tab (sessionStorage) and disappears when that tab is closed — it cannot be used to recognise the same …